Certification
Certified Information Security Management System. Independently audited and certified. Certificate available on request.
All MRFF-funded research data is handled in accordance with MRFF data governance requirements.
Data architecture
Clinical data stays within the jurisdiction of the deploying institution. Australian deployments run on Azure AU infrastructure.
Each partner organisation's data — cases, corrections, knowledge bank updates — is fully isolated. No cross-organisation data sharing or training without explicit consent.
Corrections captured through the ELI loop are used to retrain stage verifiers for the originating deployment only. We do not aggregate training data across partners.
All data encrypted at rest (AES-256) and in transit.
Clinical data handling
Summary of case context and reasoning traces are anonymised before it is available for review by experts. Re-identification controls are enforced at the infrastructure level.
We capture the reasoning signal — what the expert corrected and why — not the full patient record. Stage verifiers are trained on decision-level corrections, not raw clinical notes.
Every recommendation the system makes is logged with full provenance: which knowledge bank version, which stage verifiers, which guidelines, what confidence scores. Immutable. Exportable. Regulatorily auditable.
Retention periods are configurable. Default is aligned with Australian clinical record-keeping requirements. Deletion on request is supported and audited.
Infrastructure
Deployed on Microsoft Azure, Australian region (australiaeast).
On-premises deployment available for health systems with strict data egress requirements.
Role-based access control (RBAC) with MFA enforced for all system access.
Leveraging Microsoft Defender for Cloud provide a unified security experience across cloud and code environments. Third-party penetration test annually.
Governance
Reviewed and updated annually. Available to enterprise customers and regulators on request.
Documented IR plan. 72-hour notification SLA for notifiable data breaches under the Australian Privacy Act.
All third-party vendors assessed against our security requirements before onboarding. Critical vendors reviewed annually.
Security questions or responsible disclosure?
Reach us directly at security@uncapt.com
We respond to responsible disclosure reports within 48 hours and commit to transparency about our findings and remediation timeline.